kubernetes-client/java

CKR_SESSION_READ_ONLY in FIPS enabled environment

Opened this issue · 2 comments

florin-szilagyi commented

Describe the bug
Unable to connect to kubernetes in a fips enabled environment.
Seems very similar to this: fabric8io/kubernetes-client#3867

So I dug around a bit and it seems ApiClient is using the default keystore, instead of initializing it from the system one (as the fix was made here

Client Version
20.0.0

Kubernetes Version
1.28

Java Version
Java 17

To Reproduce
io.kubernetes.client.util.Config.fromCluster().getBasePath();

Expected behavior
A clear and concise description of what you expected to happen.

Server (please complete the following information):

  • OS: RHEL
  • Container
  • Azure

Additional context

sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
	at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java)
	at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java:1961)
	at sun.security.pkcs11.P11KeyStore.storeCert(P11KeyStore.java:1567)
	at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1045)
	... 99 common frames omitted
Wrapped by: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
	at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1049)
	at sun.security.pkcs11.P11KeyStore.engineSetCertificateEntry(P11KeyStore.java:515)
	at java.security.KeyStore.setCertificateEntry(KeyStore.java:1235)
	at io.kubernetes.client.openapi.ApiClient.applySslSettings(ApiClient.java:1336)
brendandburns commented

The current client does not use the FIPS compliant version of bouncy castle, this was fixed recently:

#3595

But is not in any release. If you can rebuild this client at HEAD you can see if that fixes things for you.

DeanTupper commented

is there any chance this going to be released any time soon? I don't see any releases for August or September. Is the suggestion here to fork and release our own artifacts for the time being?